OGG Signature format

User's guide:

OGG Audio Signature Format: Specification & OGG Recovery Example

Ogg is an open container format maintained by the Xiph.Org Foundation. OGG container format can multiplex a number of independent streams for audio, video, text (such as subtitles), and metadata.

OGG Vorbis compressed audio files must have a signature (tag) OggS (hex: 4F 67 67 53) at the beginning of the audiofile.

OGG files are organized into data segments. Each segment is prefixed with an 27 byte header:
4 byte signature (OggS) used to identify the header and storing flags, checksum and other important information.

If header's Flags field has a bit 2, or TotalSegments field is a zero, this is the end of the audio file.
At header's offset 26 there is byte, describing total segments number. After the header located sizes for each segment (one byte per segment), followed by the actual segments data. By searching for data headers and summarizing sizes for headers and data segments we can calculate total OGG file size.

When inspecting example.ogg file's text data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature OggS (hex: 4F, 67, 67, 53). At offset 26, there is a total segments number, which is 1 (hex: 01), then goes segment size 30 (hex: 1E). Next header starts at offset 58 (27+1+30).

Signature OggS (hex: 4F, 67, 67, 53) confirms this. At offset 84 (58+26), there is a total segments number, which is 1 (hex: 01), then goes segment size 16 (hex: 10). Next header starts at offset 102 (84+1+1+16). At offset 128 (102+26) we can see number of segments 13 (hex: 0D).

Following 13 bytes give us total length of all 13 segments 3242 (12*255 (hex:FF) plus 182 (hex: B6)).
Next header we should expect at offset 3384 (128 + 1 + 13 + 3242)... Calcuating and searching for OGG headers further the same way we'll pick up all Vorbis audio file data.